EUPL v1.2: Clarification on source-code disclosure & license-notice requirements for closed-source SaaS use

[juceling]

Hello,

First, I apologize if this question is not appropriate for this forum.
However, since it’s difficult to verify the relevant information accurately and you are most familiar with the original intent behind this package’s design, I decided to ask here rather than by email. I also thought others who have similar questions might benefit from the answer.

I have some uncertainties about how to handle the copyright notice and code-disclosure requirements under EUPL v1.2 when using this package.

⸻

I have already reviewed the official EUPL v1.2 documentation, but some points remain unclear:

(https://interoperable-europe.ec.europa.eu/collection/eupl/how-use-eupl)
Does the EUPL close the SaaS/ASP loophole?
Yes: the definitions in article 1 of the EUPL (unmodified in all EUPL versions so far) assimilates “communication to the public” to “distribution” and therefore targets and covers SaaS (software as a service) and the ASP (application service provider) activity.
Article 1 defines as “– Distribution or Communication: any act of selling, giving, lending, renting, distributing, communicating, transmitting, or otherwise making available, on-line or off-line, copies of the Work or providing access to its essential functionalities at the disposal of any other natural or legal person.”
Therefore on this specific point, the EUPL is similar to the AGPL. The new guidelines published in September 2021 (dated July 2021) are totally in line with this definition.

⸻

Context: How we plan to use the package and the application built with it
• Without modifying the package’s source code, we will configure Maven to include its functionality in our Java program, develop an application (“A Application/Program”), and then build it.
• We will deploy this application to the cloud (e.g., AWS), and users will access the service via our app’s REST API.
• We will not publicly share the application’s source code or build artifacts with any third parties.
• A Application/Program is a commercial, revenue-generating service.
• We intend to use this package for certain feature implementations within that program.

Questions:
1. Under the above conditions, would A Application be considered a “Derivative Work” requiring us to publicly disclose its entire source code or build artifacts?
2. If we are not required to disclose the entire source code of A Application, must we still explicitly acknowledge our use of this package (including its name and EUPL v1.2 license)?
3. If neither of the above applies, can we treat this as purely internal use and omit any notification?

I’m sorry to ask a licensing question instead of a coding question, but I couldn’t find a precise example or guidance and therefore must request your help.

Thank you for your time.